GovRAMP's 20x Delta Assessment: What FedRAMP 20x Teams Should Do Before Dec. 4

GovRAMP's proposed 20x Delta Assessment would decide which NIST SP 800-53 controls a FedRAMP 20x provider still has to show evidence for, beyond its Key Security Indicators (KSIs), to earn a GovRAMP verified status. The public comment period opened November 2, 2026 and closes December 4, 2026 at 5:00 p.m. ET. If you're pursuing FedRAMP 20x and selling to state or local government, read Part B of the proposal now. That's the section that sets your extra evidence list.

This post explains what the Delta Assessment is, what Part B proposes and what to do before the deadline. If you need the basics first (what GovRAMP is, how Core, Ready and Authorized differ and why SLED buyers ask for it), start with what GovRAMP (formerly StateRAMP) actually requires.

What is the GovRAMP 20x Delta Assessment?

It's a proposed add-on assessment that bridges FedRAMP 20x and GovRAMP's NIST-based requirements. GovRAMP published it as Request for Comments GR-2601, in response to FedRAMP's Consolidated Rules for 2026 and work by its Framework Harmonization Working Group, formed in April 2025.

According to the RFC, the Delta Assessment "may be applied alongside a FedRAMP 20x assessment, ideally during the initial review process or subsequently." Its job is to cover the areas where GovRAMP needs more testing than 20x provides. The RFC would apply it to providers pursuing GovRAMP Core, Ready or Authorized.

The scope is narrow on purpose:

• It covers only the annual assessment requirements for GovRAMP verified status.
• It doesn't change GovRAMP continuous monitoring.
• It doesn't address FedRAMP's Vulnerability Disclosure Reporting (VDR) and Vulnerability Exploitation Reporting (VER) requirements. In August 2026, GovRAMP's Standards & Technical Committee and Board directed the PMO to recognize VDR and VER as satisfying the matching continuous monitoring requirements for GovRAMP Authorized products.

How much of GovRAMP does FedRAMP 20x already cover?

GovRAMP's analysis found that FedRAMP 20x could potentially meet about 88% of GovRAMP Core, 79% of Ready and 62% of Authorized NIST control coverage. The analysis compared 20x Class B and Class C requirements against each GovRAMP status, against GovRAMP's Moderate baselines only.

"Potentially" matters. GovRAMP is explicit that "a mapped KSI may relate to a NIST control, but that alone does not prove that a provider's evidence satisfies the control." That's why the proposal has two parts.

A note on 20x classes: Class B and Class C loosely align with the Rev5 Low and Moderate impact levels, but they aren't equivalent to them. If you're still choosing a class, see FedRAMP 20x Class B vs. Class C.

What does Part A ask for?

Part A takes the controls that are mapped to 20x KSIs and adds NIST SP 800-53A assessment-objective language to each one. That language spells out the inputs and evidence an assessor should look for. The higher the GovRAMP status, the more defined the guidance. Examples are in tabs 4c and 5c of GovRAMP's 20x Delta Analysis Record workbook.

In practice, your KSI evidence may need to answer NIST-style "determine if" questions, not just show that a KSI is in place.

What does Part B decide, and why read it first?

Part B deals with the controls that GovRAMP requires but FedRAMP's machine-readable rules don't map to any 20x KSI. These are the controls with no 20x evidence to reuse. At the Moderate level, GovRAMP counts 7 for Core, 17 for Ready and 120 for Authorized.

GovRAMP proposes to filter them with the MITRE Control Protection Value from GSA's FedRAMP PMO Threat-Based Controls Scoring study, which recommended a cut score of 41.772. A control at or above the cut score would be included in the Delta Assessment. A control below it would be left out. Related controls that stay in would be grouped into new GovRAMP KSIs using NIST assessment guidance.

*GovRAMP's RFC table prints 3 for Ready, but its workbook (tab 5a) lists 17 unmapped Ready controls, 4 of them at or above 41.772, which leaves 13 below the cut. We've used the workbook figure.

For an Authorized-track provider, that's the difference between about two dozen extra controls and 120. And the controls in the table aren't abstract. Tab 4a lists Core's seven: privileged user accounts (AC-2(7)), impact analyses (CM-4), two CM-5 access-restriction enhancements, automated configuration management (CM-6(1)), maintenance tools (MA-3) and static code analysis (SA-11(1)). For Ready, tab 5a adds controls such as physical access (PE-2, PE-3 and others) and emergency power (PE-11), all of which score below the cut.

If GovRAMP affirms the approach, its staff will complete the analysis for all verified statuses and impact levels. So the method you comment on now is likely the one that gets applied beyond Moderate.

What three policy questions should you weigh in on?

The RFC also asks three direct questions where FedRAMP 20x and GovRAMP currently differ:

• System Security Plan (PL-2). FedRAMP 20x doesn't require a traditional SSP, but GovRAMP Authorized does. GovRAMP asks whether it should keep the SSP for 20x providers, vary it by status or accept alternatives such as OSCAL-formatted components.
• Annual penetration testing (CA-8). FedRAMP 20x doesn't require annual pen testing, but GovRAMP Authorized does. GovRAMP asks whether to keep the requirement, whether internal testing that meets its Penetration Testing Guidance should count and whether a 3PAO should review internal tests. In the workbook's tab 6a, which lists Authorized controls not mapped to a KSI, CA-8 appears with a MITRE Control Protection Value of 17.18, below the 41.772 cut score. PL-2, the SSP control, is listed there too, at 34.3, also below the cut.
• Malicious code protection (SI-3). FedRAMP 20x doesn't explicitly require supplemental SI-3 evidence, but GovRAMP requires it for Core, Ready and Authorized. SI-3 is mapped to 20x KSIs in the workbook's crosswalk (tab 3), so this question is about supplemental evidence, not a Part B gap. GovRAMP asks whether cloud-native evidence, such as container image scanning, CI/CD static and dynamic analysis or eBPF runtime detection, can satisfy it.

If your 20x program already produces machine-readable evidence, these are the questions where specific, practical comments are most useful.

What should you do before December 4?

1. Read Part B and open the workbook. Download the GR 20x Delta Analysis Record (large file, about 150 MB) and find the "Missing" tab for your target status (4a Core, 5a Ready, 6a Authorized). Note which controls are above the cut score.
2. Map the gaps against your own evidence. For each included control, check whether your 20x evidence, automation or existing documentation already covers it. Then do the same with Part A's assessment objectives for your mapped KSIs.
3. Pin down your SSP, pen testing and SI-3 position. Know what you produce today: an OSCAL package, a third-party or internal pen test, and cloud-native malware and scanning evidence.
4. Estimate the impact. The RFC asks respondents to rate impact, so put rough effort and cost on each option.
5. Submit a comment. The online form on GovRAMP's announcement page is preferred. You can also email rfc@govramp.org with the subject "RFC for 20x Delta Assessment", including your organization, point of contact, email, phone, GovRAMP member status and entity type. Service providers also state whether they have a Rev 5 assessment or a 20x certification, or plan one. Members and non-members can respond, and responses are reported in aggregate without attribution.

How does this fit your FedRAMP 20x timeline?

FedRAMP's Consolidated Rules for 2026 (CR26) launched on June 24, 2026, with optional adoption from July 4, 2026. They take mandatory effect on January 1, 2027, with some area-specific dates. FedRAMP opened its 20x Class B and C pipeline on August 31, 2026. GovRAMP says it will publish guidance after the RFC for providers who have already completed 20x and for those planning to. Because the RFC says the Delta Assessment would ideally run during the initial 20x review, it's worth planning both assessments together. For the broader federal sequence, see the FedRAMP 20x roadmap.

One reminder for sales teams: none of this replaces the need for the status a buyer actually names. SOC 2 is an attestation, not a certification, and it doesn't stand in for a GovRAMP verified status (see why SOC 2 won't clear multi-state SLED deals).

Next step

If you're planning FedRAMP 20x and also need a GovRAMP status for state and local deals, talk to Workstreet's public sector team about 20x and GovRAMP readiness. We can help you map the Part B gaps to your evidence and work out your SSP, pen testing and SI-3 position before you comment. That's readiness support. Workstreet isn't the GovRAMP PMO or an assessor, and GovRAMP's final guidance decides what's required.

Sources

• GovRAMP, GovRAMP Opens Public Comment Period on Proposed 20x Delta Assessment (Nov 2, 2026)
• GovRAMP, Request for Comments GR-2601
• GovRAMP, GR 20x Delta Analysis Record (workbook)
• FedRAMP, Consolidated Rules for 2026 changelog
• FedRAMP, Important Dates for the Consolidated Rules for 2026